Read the docs
TI-2026-68377 Aliases CVE-2026-105767GHSA-vh2r-m6q8-8hp3

Command injection in Chainguard Academy integrate-platform-docs action

Priority LOW 10CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Chainguard Academy (edu) integrate-platform-docs composite action from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 is affected. Its steps interpolate the project_id and storage_bucket inputs into Bash gcloud storage cp commands, which allows OS command injection (CWE-78). An actor who controls those inputs can run arbitrary shell commands on the GitHub Actions runner. The only in-repository caller runs only on trusted triggers.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00185 8th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

Commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 is the first unaffected commit, and the sources list no fixed version for Chainguard Academy (edu) integrate-platform-docs.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105767
  2. 2026-10-06 Alias added: GHSA-vh2r-m6q8-8hp3
  3. 2026-10-06 CISA SSVC decision points changed

References

Patch 2

  • TI-2024-23955 apko Exposure of HTTP basic auth credentials in log output CVSS 3.1HIGH 7.5
  • TI-2026-22680 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory CVSS 3.1HIGH 8.2
  • TI-2026-83911 kaniko sends Azure access tokens to lookalike ACR registry hosts CVSS 3.1CRITICAL 9.3
  • TI-2026-30854 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVSS 3.1HIGH 7.5
  • TI-2026-20302 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams CVSS 3.1HIGH 7.5
  • TI-2026-20284 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences